KR20110040152A - Method for reverse tracking of attaker packet and system for the same - Google Patents

Abstract

PURPOSE: A method for reversely tracking an attacker packet and a system therefore are provided to sense the attacker packet by using a hash function and a bloom filter. CONSTITUTION: A first router(100) receives a hash information list of an attacker packet from a server(300) which reversely track an attack path of the attacker packet in a network. A hash value is extracted by applying a hash function to a reception packet. It is determined whether the information corresponding to the extracted hash value exists in the hash information list. The reception packet is determined to the attacker packet according to the information corresponding to the extracted hash value. The determination result is transmitted to the server.

Description

Method for reverse tracking of attaker packet and System for the same}

The present invention relates to an attacker packet traceback method for tracking specific data and hacking of systems and services in the Internet environment, and a system therefor.

The present invention is derived from a study conducted as part of the IT growth engine technology development project of the Ministry of Knowledge Economy. [Task Management Number: 2007-S-022-03, Title: Intelligent Cyber Attack Monitoring and Tracking System in All-IP Environment] Development].

As a variety of hacking and cyber crimes using the Internet are rapidly increasing, a backtracking system that tracks the actual location of hackers is being developed as a security enhancement system to protect the system and network.

The above traceback technique is a process of finding the actual transmission source of the IP packet.

Although the sender's IP address value is recorded in the IP packet header in the process of transmitting the packet, the attacker can change the source IP where the actual packet is transmitted (IP Spoofing) and transmit it.

Therefore, only the source IP value recorded in the header of the IP packet received from the receiver side makes it difficult to identify the source address of the actual packet.

Looking at the existing traceback technology, first, if the reply address of the packet is inappropriate in the originating system, a filtering process such as discarding the received packet may be performed. This is a technique included in most existing routers and firewalls, but it may degrade the performance of the router or firewall system because every return of the return address value corresponding to the regression address must be determined for every individual packet. There are disadvantages.

Alternatively, there is a traceback method using the agent movement method, which installs an agent on the attacked system and analyzes the log information of the attacked system to obtain attack packet information.

If the attacked system is one of the n paths, the agent is installed on the attacked system to analyze the log information and to obtain attack packet information by repeating the process of obtaining the attack packet information to the first waypoint server of the final network intruder. Can be. Therefore, this method consumes a lot of time and resources to track down the attacker's source, which causes inefficiency.

As another method, it is proposed that the edge router of each network records log information about all packets accessed internally so that the traceback of the packets is possible regardless of the attacker's IP address change. In addition, since the log information recorded in the plurality of edge routers must be analyzed, there is a problem in that the backtracking process takes a lot of time.

The present invention is to solve the above problems, by using a hash function and the bloom filter method to detect the attacker packet generated in the network, and analyzes the path of the router receiving the attacker packet to attack the attacker packet The present invention relates to an attacker packet traceback method for accurately finding a path and a system therefor.

In order to achieve the above object, an attacker packet backtracking method of a first router for determining an attacker packet according to the present invention includes a hash information list of attacker packets from a server that the first router traces back the attack path of an attacker packet in a network. Receiving; Extracting a hash value by applying a hash function to the received packet; Checking whether information corresponding to the extracted hash value exists in the hash information list; If the result of the check is present, determining the received packet as an attacker packet; And notifying the server of the determination result.

In this case, the receiving step may include transmitting information on a hash function of a first router to the server; And receiving a hash information list of attacker packets related to a hash function of the first router from the server.

In addition, the checking step may check whether information corresponding to the extracted hash value exists in the hash information list by using a bloom filter.

In addition, the attacker packet traceback method according to the present invention comprises the steps of: receiving information of a second router in the network from the server; Stopping routing of the determined attacker packet; And transmitting the attacker packet to a second router. In this case, the second router may sinkhole the attacker packet, and transmit an identifier (ID) of the first router that transmitted the attacker packet to the server for analyzing an attacker packet attack path of the server. have.

In addition, the attacker packet backtracking method of the server to trace back the attack path of the attacker packet according to the present invention, the server manages the first router for inspecting the attacker packet in the network and the attacker packet checked in the first router Selecting a second router for the network; Transmitting a hash information list of attacker packets provided to the first router; Receiving a result of determining that the received packet of the first router is an attacker packet through the second router; And tracing back the attacker packet by identifying a path of the first router from which the attacker packet was received.

In addition, the attacker packet traceback system according to the present invention, extracts the hash value of the received packet, and corresponds to the extracted hash value in the hash information list of the attacker packets provided by using a Bloom Filter (Bloom Filter) A first router, if the information is present, determining the received packet as an attacker packet and transmitting the attacker packet; A second router for receiving and sinking the attacker packet from the first router and transmitting a result of determining the attacker packet of the first router; When the attacker packet determination result of the first router is received from the second router, the server to determine the path of the first router to trace back the attack path of the attacker packet;

The attacker packet backtracking method and system for the same according to the present invention can manage / control the entire network in a much simpler manner than the backtracking system of the conventional logging method, so that it is easy to respond to an attack.

In addition, the information on the attacker packet can be stored for a long time with a minimized bloom filter value, and when an attack occurs, it provides an effective attack detection and tracking function because it provides a management structure for the router in the unit network.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a diagram illustrating an attacker packet traceback system according to the present invention.

Referring to FIG. 1, the system 400 according to the present invention may perform a sinkhole processing on an attacker packet of a first router 100 and an attacker packet of an incoming packet. The second router 200 and the tracer server 300 which traces back the path of the attacking host 500 that generated the attacker packet by analyzing the path of the first router 100 where the attacker packet is generated. It is configured by.

The first router 100 corresponds to intermediate network equipment that transmits and receives network traffic.

The first router 100 grasps the transmission path of the entire packet using the BGP protocol, and delivers the packet using a routing method such as RIP or OSPF by looking at the recipient IP address recorded in the IP header of the packet. To provide.

The second router 200 that performs the sinkhole process is selected by the backtracking server 300, and performs the function of the general router of the first router 100, and separately performs the attack host 400 on the entire network. When an attack occurs, the attacker packet is transmitted from the first router 100 to provide an attacker packet collection function when DDoS occurs, while performing additional functions such as analysis, filtering, and traceback.

The traceback server 300 selects a second router 200 for sinkhole processing of attacker packets among routers connected in a network, and manages attack traffic of the attacking host 500 for a predetermined size of network. And it provides a verification function and provides a function to determine the actual transmission path, etc. of the attacker packet when an attack of the attacking host 500 occurs.

The traceback server 300 as described above may request setting for traceback of the attacker packet generated by the attacking host 500, management of the attacker packet, information notification about the attacker packet, and each router 100, By collecting the information of the 200, it performs the overall management function for the back trace of the attacker packet.

Hereinafter, the configuration of the backtracking server 300 according to the present invention will be described in detail with reference to FIG. 2.

2 is a functional block diagram illustrating a backtracking server according to the present invention.

Referring to FIG. 2, the backtracking server 300 includes a protocol processor 310, a router manager 320, an attacker packet manager 330, and a storage 340.

The protocol processor 310 processes a protocol for communication with the first and second routers 100 and 200 and will be described in detail later with reference to FIG. 6.

The router manager 320 searches for all routers connected in the network, generates an information list of the discovered routers, stores the generated information list of the routers in the storage unit 340, and manages and controls all the routers. Function

At this time, if the information list of the routers exist in the storage unit 340, the router manager 320 updates the information list of the generated routers to the list provided in the storage unit 340.

In addition, the router manager 320 sets a second router 200 that sinks an attacker packet in routers managed by the router manager 320, and maintains, updates, and manages information of all routers in the network.

At this time, routers other than the second router 200 among the routers in the network determine the attacker packet with respect to the received packet. Hereinafter, for convenience of description, routers other than the second router 200 among the routers in the network are collectively referred to as the first router 100.

The attacker packet manager 330 receives the information on the attacker packet generated in the first router 100 from the second router 200 through the protocol processor 310, and adds the packet to the attacker packet list in the storage unit 340. Update the received attacker packet information.

In addition, since the reverse path of the first router 100 in which the attacker packet is received is the path of the attacking host 500 that generated the attacker packet, the attacker packet manager 330 determines that the first router 100 in which the attacker packet is received. ) Is recognized as the attack path of the attack host 500, and the first router 100 updates the path to the attack path list in the storage unit 340.

The storage unit 340 stores data for controlling the operation of the traceback server 300, and includes a router information list, a hash function list, an attack packet list, and an attack path list.

The router information list includes IDs of all routers managed by the traceback server 300 in the network, communication information for protocol communication, and hash function information.

The ID is a unique number for managing routers, and the communication information is network information for transmitting and receiving a message, and may vary according to network conditions.

The hash function information is provided to extract a hash value such as a router as information of a hash performed by a router.

The hash function list stores hash functions of all routers managed by the traceback server 300. If the router information contains only the index of the hash function, the hash functions exist in the actual hash function list.

The attack packet list is a list of packets for which an actual attack was made. The attack packet list is the actual attack packet obtained by the security administrator or at the request of Victim. The security manager may select a packet sent to the second router 200 from the attack packet list.

The attack path list is an ID of the first router 100 that sends attack packets received by the second router 200 to attack packets applied to each router. The ID of the first router 100 is information for analyzing the origin or attack path of the attacking host 500.

The router manager 320 functions to acquire and manage information of all routers managed by the traceback server 300 as a task that is performed before the traceback server 300 is first started.

In addition, the backtracking server 300 transmits the hashed value of the attack packet to the first router 100 to obtain hash information of each router so that the first router 100 processes the attack packet. To do the job.

The attack packet manager 330 is responsible for performing a back trace on the attack traffic. The attack packet manager 330 allows the first router 100 to send the attack packet to the second router 200 through registration of the attack packet.

The traceback server 300 transmits a hash information list of attack packets provided to the first router 100.

The hash value of the attack packets in the hash information list is a hash value suitable for the hash function set in the first router 100. In this case, since the first router 100 uses a bloom filter, the first router 100 may determine whether the corresponding attack packet has passed through itself by using the hash value received through the attack packet registration, and thus the backtracking server. 300 may determine an attack path with respect to the attack packet.

3 is a functional block diagram illustrating a first router according to the present invention.

Referring to FIG. 3, the first router 100 includes a protocol processor 110, a packet processor 120, a bloom filter processor 130, an attack packet processor 140, and a storage 150. It is configured by.

The protocol processor 110 processes a protocol for communication with the second router 200 and the traceback server 300, and when communication is connected with the second router 200 and the traceback server 300, the second router The network information of the 200 and the traceback server 300 is stored in the storage 150.

In addition, the protocol processing unit 110 transmits information on the hash function set in the first router 100 to the backtracking server 300, and the hash set in the first router 100 from the backtracking server 300. The hash information list of attacker packets suitable for the function is received and stored in the storage unit 150.

The packet processor 120 extracts two different hash values by applying two hash functions to the received packet.

The bloom filter processor 130 checks whether information corresponding to the extracted hash values exists in a hash information list of attacker packets stored in the storage unit 150 using a bloom filter.

The attack packet processing unit 140 determines that the received packet is an attacker packet if the information corresponding to the extracted hash values exists in the list as a result of the inspection of the bloom filter processing unit 130.

Thereafter, the attack packet processing unit 140 stops routing of the received packet determined as the attacker packet, and notifies the server 300 that the received packet is an attacker packet through the protocol processing unit 110, and the determined attacker The packet is transmitted to the second router 200.

In this case, in the processing of the determined attacker packet, the packet processing unit 120 extracts an IP packet passing through itself so that the backtracking server 300 performs a task required for backtracking the attacker packet. After analyzing values such as information of the IP header of the extracted packet, the operation for backtracking proceeds.

Hereinafter, a process of extracting a hash value of a received packet by the first router 100 will be described in detail with reference to FIG. 4 as an example.

4 is a diagram illustrating a process of extracting a hash value of a received packet by a first router according to the present invention.

Referring to FIG. 4, the packet processing unit 110 of the first router 100 extracts specific information of the IP header and a part of the payload before hashing the received packet. The extracted information is 24 bytes of information, and two hash functions are used to extract two 32-bit hash values.

Looking at the operation of the hash function applied to the first router 100 in detail as follows. Cryptographically secure hash functions can use the SHA-256 function. In this case, when a packet corresponding to an arbitrary bit enters the input, it always has an output value of 256 bits.

In this case, since the overall size of the bloom filter is affected by the size of the output bit of the hash function, 32 bits is generally appropriate considering the storage capacity and the size of the bloom filter.

Therefore, in the present invention, the hash value of the 32-bit value is finally calculated by using the folding method as shown in FIG. 4 while using the SHA-256 function known to be cryptographically secure.

The bloom filter processor 130 applies a bloom filter to record two hash values extracted by the packet processor 120. Thereafter, the bloom filter processor 130 performs a backtracking function on the attack traffic by inspecting the bloom filter and determining that an attacker packet has passed.

More specifically, the two hash values received from the traceback server 300 using the protocol are hash values of attack packets hashed from their hash functions. If the value has passed by you, it will be recorded in the Bloom filter, so you can check quickly. By verifying that the packet has passed through it and sending the result back to the traceback server 300, it helps the traceback server 300 to determine the attack path of the attacker packet, and uses the Bloom filter for this task. do.

5 is a functional block diagram illustrating a second router according to the present invention.

Referring to FIG. 5, the second router 200 includes a protocol processor 210, an attack packet processor 220, and a storage 230.

The protocol processor 210 is communicatively connected to the first router 100 and the traceback server 300 and stores the attacker packet received from the first router 100 in the storage 230.

The attack packet processing unit 210 sinks the attacker packet received from the first router 100 and transmits the attacker packet to the attacker packet attack path analysis of the traceback server 300. The identifier (ID) is transmitted to the backtracking server 300.

Attacker packets managed by the second router 200 may be viewed according to the request of the traceback server 300 and may be analyzed by the security manager.

6 shows a protocol structure diagram between the backtracking server and the first and second routers according to the present invention.

Referring to FIG. 6, the first router 100 determines whether the received packet is an attacker packet using a hash value of the received packet and a bloom filter. If the received packet is an attacker packet, the first router 100 converts the attacker packet to the second router. The server 200 transmits the data to the 200 and the backtracking server 300 manages the first and second routers 100 and 200 to perform the analysis for the backtracking of the attack.

For the above-described process, communication between the backtracking server 300 and the first router 100, the first router 100 and the second router 200, and the second router 200 and the backtracking server 300 is required. This corresponds to the protocol processor 110, 210, 310 of FIGS. 2, 3, and 5.

The protocol consists of messages such as settings, commands, and notifications sent by the traceback server 300 to the first and second routers 100 and 200 and attacker packets sent by the first router 100 to the traceback server 300. The path is included.

In FIG. 6, 'Start Code' is a value for distinguishing a protocol. It has a fixed value of 1 byte and is used as a value to distinguish it from other protocols.

The 'Message Header' includes the ID of the sender, the ID of the destination, the length of the entire message, and the CRC code of the message.

The ID is a unique number starting from '1' in any of the first and second routers 100 and 200, and the backtracking server 300 has an ID of '0'.

The message length is the byte size of the entire message starting from 'Start Code'.

The CRC code is a value obtained by obtaining the CRC of the value excluding the CRC code part from the beginning of the 'Message Header' to the end of the 'Message Body'.

'Message Body' contains the actual message information. It contains a 2-byte request ID and varies in size depending on the message.

7 shows a process of a first router using a bloom filter.

Referring to FIG. 7, the first router 100 extracts information of a received packet to obtain two hash values. The hash values are values applied to the bloom filter, and it is determined whether the packet has passed by using the value recorded in the bloom filter.

8 shows a backtracking process of an attacker packet.

Referring to FIG. 8, there are two methods of backtracking the attacker packet, real time or post attack path reconstruction.

The real-time traceback process transmits the packet determined by the first router 100 to the second router 200, and the second router 200 receiving the attacker packet from the first router 100 transmits the traceback server ( 300) by informing the information of the attacker packet.

In addition, the post attack path reconfiguration process requires the traceback server 300 to request the first and second routers 100 and 200 to register the attacker packet, and each router 100 and 200 sends the attack packet to itself. It is made while notifying the backtracking server 300 that it has passed.

In the actual attack state, the backtracking server 300 applies a hash function of the first router 100 to the attacker packet, extracts a hash value, and transmits the extracted hash value to the first router 100. .

The first router 100 receiving the hash value from the backtracking server 300 checks whether the attacker packet has passed through itself using a bloom filter, and checks the check result through the second router 200. Notified by 300.

The traceback server 300 detects the path of the first router 100 through which the attacker packet passes, and traces back the attack path of the attacker packet.

Meanwhile, the first router 100 has a list of attacker packet hash information received from the traceback server 300.

In the hash information list of the attacker packet, when the same packet arrives at the first router 100, the first router 100 transmits the attacker packet to the second router 200, and the second router 200 While storing the attacker packets, the traceback server 300 informs the information about the attacker packets. This allows tracking of attacker packets in the network unit managed by the backtracking server 300 in real time.

9 is a signal processing diagram illustrating an attacker packet traceback process of the system according to the present invention.

Referring to FIG. 9, the backtracking server 300 and the first and second routers 100 and 200 in the network are in communication with each other [S111, S112], and the backtracking server 300 is currently connected in the network. Among the routers, the first router 100 and the second router 200 are selected, the first router 100 requests the inspection of the attacker packet [S113], and the second router 200 the attacker packet for the Sinkhole processing and attacker packet management is requested [S114].

At this time, when the first router 100 detects an attacker packet, the backtracking server 300 may transmit the attacker packet to the second router 200 by the first router 100. The network information of the second router 200 is transmitted to 100.

The backtracking server 300 requests information related to the hash function used for the bloom filter from the first router 100 [S115].

The first router 100, at the request of the backtracking server 300, grasps information related to the hash function currently used for the bloom filter, and transfers the information related to the identified hash function to the backtracking server 300. To transmit [S116].

When the backtracking server 300 receives the hash function related information used for the bloom filter of the first router 100, the backtracking server 300 may include hash information of the provided attacker packets related to the hash function of the received first router 100. And converts the hash information list of the converted attacker packets to the first router 100 [S117].

The first router 100 stores a hash information list of attacker packets received from the traceback server 300, and extracts two hash values by applying two hash functions to the packets passing through the network in the network. [S118]. In this case, two hash functions applied to the packet are hash functions used for the bloom filter of the first router 100.

The first router 100 checks whether the extracted hash values exist in the list received from the backtracking server 300 using the bloom filter [S119], and if the hash values exist in the list [S120]. The packet is determined to be an attacker packet [S121].

The first router 100 stops routing the attacker packet, notifies the traceback server 300 that the packet is the attacker packet, and transmits the attacker packet to the second router 200 [S122].

When the attacker packet is received from the first router 100, the second router 200 sinks the attacker packet [S123], and the traceback server 300 may analyze the attack path of the attacker packet. The ID of the first router 100 that has transmitted the attacker packet is transmitted to the traceback server 300 [S124].

The traceback server 300 detects the path of the first router 100 where the attacker packet is received and traces back the attacker packet [S125].

According to the present invention, since the entire network can be managed / controlled in a much simpler manner than the conventional backtracking system of the logging method, it is easy to respond to an attack.

In addition, the information on the attacker packet can be stored for a long time with a minimized bloom filter value, and when an attack occurs, it provides an effective attack detection and tracking function because it provides a management structure for the router in the unit network.

It will be apparent to those skilled in the art that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof.

The present invention described above can be embodied as computer-readable codes on a medium on which a program is recorded. The computer readable medium includes all kinds of recording apparatuses in which data which can be read by a computer system is stored. Examples of computer-readable media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (eg, transmission over the Internet). It also includes.

Accordingly, the above detailed description should not be construed as limiting in all aspects and should be considered as illustrative. The scope of the invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the invention are included in the scope of the invention.

The attacker packet traceback method described above and the system therefor are not limited to the configuration and method of the embodiments described above, but the embodiments may be all or part of each embodiment so that various modifications may be made. May be optionally combined.

1 is a diagram illustrating an attacker packet traceback system according to the present invention.

2 is a functional block diagram illustrating a backtracking server according to the present invention.

3 is a functional block diagram illustrating a first router according to the present invention.

4 is a diagram illustrating a process of extracting a hash value of a received packet by a first router according to the present invention.

5 is a functional block diagram illustrating a second router according to the present invention.

6 shows a protocol structure diagram between the backtracking server and the first and second routers according to the present invention.

7 shows a process of a first router using a bloom filter.

8 shows a backtracking process of an attacker packet.

9 is a signal processing diagram illustrating an attacker packet traceback process of the system according to the present invention.

Claims (7)

Receiving, by the first router, a hash information list of attacker packets from a server that traces back the attack path of the attacker packet in the network; Extracting a hash value by applying a hash function to the received packet; Checking whether information corresponding to the extracted hash value exists in the hash information list; Determining the received packet as an attacker packet if the check result exists; And Notifying the server of the determination result. The method according to claim 1, The receiving step, Transmitting information about a hash function of a first router to the server; And Receiving a list of hash information of attacker packets associated with a hash function of the first router from the server. The method according to claim 1, The inspection step, And a block filter to check whether information corresponding to the extracted hash value exists in the hash information list. The method according to claim 1, Receiving information of a second router in the network from the server; Stopping routing of the determined attacker packet; And And sending the attacker packet to a second router. The method according to claim 4, The second router, Sinkhole processing of the attacker packet, and transmitting the identifier (ID) of the first router that sent the attacker packet to the server for the attacker packet attack path analysis of the server. Traceback method. Selecting, by a server that traces an attack path of an attacker packet, a first router for inspecting the attacker packet and a second router for managing attacker packets checked by the first router in a network; Transmitting a hash information list of attacker packets provided to the first router; Receiving, via the second router, a result of determining that the received packet of the first router is an attacker packet; And Tracing the path of the first router from which the attacker packet was received and back tracing the attacker packet. Extracting the hash value of the received packet, and if the information corresponding to the extracted hash value exists in the hash information list of the attacker packets provided by using a Bloom Filter, determine the received packet as an attacker packet A first router for transmitting the attacker packet; A second router receiving and sinking the attacker packet from the first router and transmitting a result of determining the attacker packet of the first router; And And a server configured to determine the path of the first router and trace back the attack path of the attacker packet when the attacker packet determination result of the first router is received from the second router.

Images